This page is maintained by Gulfstream Strategic Placements to answer common security and privacy questions about gulfstreamsp.com. It describes current, app-visible practices and is not an independent certification or audit attestation.
When you apply, your resume and the details you send go into our applicant tracking system, where our recruiting team works from them.
We share a candidate's details with an employer only with the candidate's permission. Until you say yes, your resume stays with us.
We do not name the employer in job postings or in outreach. If you are contacted about a role, we tell you what the job involves and who we are, and the company's name comes out only once you have agreed to be moved forward.
Replacement searches are kept confidential. We do not contact your current employer without asking you first.
Our forms collect only what they need to do their job. An application asks for your name, email address, phone number if you give one, the job you are applying to, and your resume. Job alerts ask for your name, email, and the areas you want work in. Contact and client-request forms ask for your name, email, phone, and your message.
We do not sell personal information. We do not hand your resume or contact details to an employer without your permission.
Full details of what each form collects and how to ask us to delete it are in our privacy policy.
If you want your information removed, email hello@gulfstreamsp.com and we will delete it. Tell us which email address you applied or signed up with so we can find the right record.
Account sign-in is handled through our managed authentication provider (Supabase Auth) using email and password. Sessions are issued as signed tokens stored in the browser.
Administrative and internal tools are gated behind role checks enforced server-side, not in the browser alone.
Application data is stored in a managed Postgres database with row-level security enabled on user-facing tables. Access policies restrict each request to the records the caller is permitted to see.
Sensitive internal tables (audit logs, webhook events, processing logs) are restricted to backend service code and administrators.
Resumes submitted through the job-application form are stored in a private storage bucket. Files are not publicly listable; access is granted to our recruiting team through short-lived signed URLs.
Uploads are validated server-side and constrained to an application-submissions path to prevent traversal into unrelated storage locations.
All traffic to gulfstreamsp.com is served over HTTPS. API keys and integration credentials are stored as server-side secrets and are never embedded in client-side code.
Backend automation endpoints require an admin API key and reject unauthenticated requests.
Our hosting platform (Lovable) and database provider (Supabase) operate the underlying infrastructure, including network isolation, patching, and physical security of the data centers.
Gulfstream Strategic Placements is responsible for how the application is configured, what data is collected, who has administrative access, and how candidate and client information is used in our recruiting workflow.
Candidates and clients are responsible for keeping their account credentials confidential and for the accuracy of information they submit.
If you believe you have found a security issue affecting gulfstreamsp.com, please contact us at hello@gulfstreamsp.com with a description of the issue and steps to reproduce. We ask that you give us reasonable time to investigate and remediate before any public disclosure.
This page reflects current, app-visible controls and is updated as our practices change. It is not a substitute for a contractual data processing agreement; for procurement or vendor-review questions, contact us at hello@gulfstreamsp.com.